Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SQL injection in TYPO3 extension CVE-2021-38302, GHSA-hqm2-gwqf-r5g5 | Critical | 1.0% | 13 Aug, 2021 | Packagist ecodev/newsletter |
Deserialization of Untrusted Data in codeception/codeception CVE-2021-23420, GHSA-4574-qv3w-fcmg, SNYK-PHP-CODECEPTIONCODECEPTION-1324585 | Critical | 2.7% | 11 Aug, 2021 | Packagist codeception/codeception |
NukeViet SQL Injection vulnerability CVE-2020-21809, GHSA-m8jx-mxf9-2rpw | Critical | 1.6% | 30 Jul, 2021 | Packagist nukeviet/nukeviet |
NukeViet SQL Injection vulnerability via topicsid parameter CVE-2020-21808, GHSA-84gf-rw24-pfqg | Critical | 1.6% | 30 Jul, 2021 | Packagist nukeviet/nukeviet |
Code injection in topthink/think CVE-2020-17952, GHSA-ch3r-vp46-8g22 | Critical | 2.5% | 26 Jul, 2021 | Packagist topthink/think |
SQL Injection in Subrion CMS CVE-2020-18155, GHSA-7q44-gfvq-6g93 | Critical | 1.3% | 14 Jul, 2021 | Packagist intelliants/subrion |
Craft CMS Remote Code Injection CVE-2021-27903, GHSA-x2j7-6hxm-87p3 | Critical | 2.8% | 30 Jun, 2021 | Packagist craftcms/cms |
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem CVE-2021-32708, GHSA-9f46-5r25-5wfm | Critical | 3.5% | 24 Jun, 2021 | Packagist league/flysystem |
Moodle command execution vulnerability exists in the default legacy spellchecker plugin BIT-moodle-2021-21809, CVE-2021-21809, GHSA-c7jj-vfmr-j9mj | Critical | 24.2% | 23 Jun, 2021 | Packagist moodle/moodle |
elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE CVE-2021-32682, GHSA-wph3-44rj-92pr | Critical | 69.9% | 14 Jun, 2021 | Packagist studio-42/elfinder |
elFinder unsafe upload filtering leading to remote code execution CVE-2021-23394, GHSA-qm58-cvvm-c5qr, SNYK-PHP-STUDIO42ELFINDER-1290554 | Critical | 18.9% | 13 Jun, 2021 | Packagist studio-42/elfinder |
XSS vulnerability with translator CVE-2021-32671, GHSA-5qjq-69w6-fg57 | Critical | 40.0% | 07 Jun, 2021 | Packagist flarum/core |
Server-Side Request Forgery in Feehi CMS CVE-2021-30108, GHSA-gc45-j3m5-8qfq | Critical | 1.1% | 24 May, 2021 | Packagist feehi/cms |
Improper Certificate Validation in WP-CLI framework BIT-wp-cli-2021-29504, CVE-2021-29504, GHSA-rwgm-f83r-v3qj | Critical | 1.3% | 19 May, 2021 | Packagist wp-cli/wp-cli |
Drupal Core Access bypass vulnerability BIT-drupal-2020-13665, CVE-2020-13665, GHSA-wxqp-jwc9-g39x | Critical | 1.3% | 05 May, 2021 | Packagist drupal/core Packagist drupal/drupal |
Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain CVE-2021-30492, GHSA-q348-f93x-9gx4 | Critical | Not scored | 29 Apr, 2021 | Packagist zendesk/zendesk_api_client_php |
Object injection in PHPMailer/PHPMailer BIT-phpmailer-2020-36326, BIT-wordpress-2020-36326, BIT-wordpress-multisite-2020-36326, CVE-2020-36326, GHSA-m298-fh5c-jc66 | Critical | 3.1% | 28 Apr, 2021 | Packagist phpmailer/phpmailer |
Insecure Deserialization of untrusted data in rmccue/requests CVE-2021-29476, GHSA-52qp-jpq7-6c54 | Critical | 2.1% | 27 Apr, 2021 | Packagist rmccue/requests |
Backport for CVE-2021-21024 Blind SQLi from Magento 2 CVE-2021-21427, GHSA-fvrf-9428-527m | Critical | 1.1% | 21 Apr, 2021 | Packagist openmage/magento-lts |
Fixes a bug in Zend Framework's Stream HTTP Wrapper CVE-2021-21426, GHSA-m496-x567-f98c | Critical | 1.2% | 21 Apr, 2021 | Packagist openmage/magento-lts |
SQL Injection in tribalsystems/zenario CVE-2021-26830, GHSA-w4f3-7f7c-x652 | Critical | 4.6% | 16 Apr, 2021 | Packagist tribalsystems/zenario |
After order payment process manipulation in shopware/platform and shopware/core GHSA-88rc-3p98-rgvx | Critical | Not scored | 13 Apr, 2021 | Packagist shopware/core Packagist shopware/platform |
Leak of information via Store-API aggregations in shopware/platform and shopware/core GHSA-qg7c-q3vq-rgxr | Critical | Not scored | 13 Apr, 2021 | Packagist shopware/core Packagist shopware/platform |
SQL injection in vhs (aka VHS: Fluid ViewHelpers) CVE-2021-28381, GHSA-wq4r-8342-jmc9 | Critical | 1.1% | 16 Mar, 2021 | Packagist fluidtypo3/vhs |
ShopXO RCE Vulnerability CVE-2021-27817, GHSA-xx77-w6p5-xvmj | Critical | 3.2% | 15 Mar, 2021 | Packagist shopxo/shopxo |
qcubed PHP object injection CVE-2020-24914, GHSA-7w3c-jgh7-cwjw | Critical | 5.0% | 04 Mar, 2021 | Packagist qcubed/qcubed |
qcubed SQL injection vulnerability in profile.php via the strQuery parameter CVE-2020-24913, GHSA-8fj6-pc5r-347q | Critical | 40.9% | 04 Mar, 2021 | Packagist qcubed/qcubed |
PHP Code Injection by malicious function name in smarty CVE-2021-26120, GHSA-3rpf-5rqv-689q | Critical | 82.3% | 22 Feb, 2021 | Packagist smarty/smarty |
Magento vulnerable to a file upload restriction bypass BIT-magento-2021-21014, CVE-2021-21014, GHSA-269w-pqc7-68q9 | Critical | 4.2% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XPath Injection BIT-magento-2021-21025, CVE-2021-21025, GHSA-h437-qjj9-vmq4 | Critical | 3.3% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Blind SQL Injection in the Search module BIT-magento-2021-21024, CVE-2021-21024, GHSA-rj4f-cp4v-hvcv | Critical | 2.8% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento XML injection in the Widgets module BIT-magento-2021-21019, CVE-2021-21019, GHSA-mw95-gmw4-883p | Critical | 3.6% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento OS Command Injection BIT-magento-2021-21018, CVE-2021-21018, GHSA-rv48-v862-mp92 | Critical | 4.0% | 11 Feb, 2021 | Packagist magento/community-edition |
Magento OS command injection via the WebAPI BIT-magento-2021-21016, CVE-2021-21016, GHSA-792f-c8mp-2cr5 | Critical | 4.9% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Exposure of Sensitive Information to an Unauthorized Actor CVE-2021-32711, GHSA-2p89-5f22-8qvf, GHSA-f2vv-h5x4-57gr | Critical | 1.4% | 10 Feb, 2021 | Packagist shopware/platform |
Mautic is vulnerable to XSS vulnerability CVE-2020-35125, GHSA-42q7-95j7-w62m | Critical | 2.7% | 09 Feb, 2021 | Packagist mautic/core |
October CMS Session ID not invalidated after logout CVE-2021-3311, GHSA-7ggw-h8pp-r95r | Critical | 2.9% | 05 Feb, 2021 | Packagist october/rain |
Steam Socialite Provider v1 does not correctly validate openid server GHSA-hhw9-35p2-q2c5 | Critical | Not scored | 29 Jan, 2021 | Packagist socialiteproviders/steam |
XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic CVE-2020-35124, GHSA-39wj-j3jc-858m | Critical | 2.4% | 19 Jan, 2021 | Packagist mautic/core |
Mautic stored Cross-site Scripting (XSS) CVE-2020-35129, GHSA-3px5-wjh3-9x6r | Critical | 1.0% | 19 Jan, 2021 | Packagist mautic/core |
Mautic stored Cross-site Scripting (XSS) CVE-2020-35128, GHSA-98j2-3jv7-274m | Critical | 1.7% | 19 Jan, 2021 | Packagist mautic/core |
ThinkAdmin insecure unserialize vulnerability CVE-2020-23653, GHSA-4vp2-mj4m-69m4 | Critical | 4.3% | 13 Jan, 2021 | Packagist zoujingli/thinkadmin |
Unauthenticated remote code execution in Ignition CVE-2021-3129, GHSA-4qwp-7c67-jmcc | CriticalExploited | 99.9% | 12 Jan, 2021 | Packagist facade/ignition |
Remote code execution in zendframework and laminas-http CVE-2021-3007, GHSA-xx8f-qf9f-5fgw | Critical | 75.3% | 04 Jan, 2021 | Packagist laminas/laminas-http Packagist zendframework/zendframework |
SQL Injection in NukeViet CVE-2019-7726, GHSA-q4qv-fmwc-qxpx | Critical | 2.3% | 31 Dec, 2020 | Packagist nukeviet/nukeviet |
Deserialization of Untrusted Data in NukeViet CVE-2019-7725, GHSA-32wr-8wxm-852c | Critical | 2.6% | 31 Dec, 2020 | Packagist nukeviet/nukeviet |
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 CVE-2020-26255, GHSA-g3h8-cg9x-47qw | Critical | 1.5% | 08 Dec, 2020 | Packagist getkirby/cms Packagist getkirby/panel |
Magento 2 Community Edition RCE via Unsafe File Upload BIT-magento-2020-24407, CVE-2020-24407, GHSA-7pxg-6p87-8c9v | Critical | 5.3% | 09 Nov, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
phpMyAdmin SQL injection vulnerability BIT-phpmyadmin-2020-26935, CVE-2020-26935, GHSA-7ff4-cv53-4cjq | Critical | 63.7% | 10 Oct, 2020 | Packagist phpmyadmin/phpmyadmin |
Potential Remote Code Execution vulnerability CVE-2020-15227, GHSA-8gv3-3j7f-wg94 | Critical | 34.4% | 01 Oct, 2020 | Packagist nette/application |